{"id":"GHSA-7rp6-w7mg-h8rw","summary":"XML External Entity Reference in Apache Jena","details":"A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.","aliases":["CVE-2021-39239"],"modified":"2024-12-02T05:44:08.734527Z","published":"2021-09-20T20:22:05Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-09-17T18:29:23Z","nvd_published_at":"2021-09-16T15:15:00Z","cwe_ids":["CWE-611"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39239"},{"type":"PACKAGE","url":"https://gitbox.apache.org/repos/asf?p=jena.git"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45@%3Cdev.jena.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d@%3Cdev.jena.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d@%3Cannounce.apache.org%3E"}],"affected":[{"package":{"name":"org.apache.jena:jena-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.jena/jena-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"versions":["2.10.0","2.10.1","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.13.0","2.7.0-incubating","2.7.1","2.7.2","2.7.3","2.7.4","3.0.0","3.0.1","3.1.0","3.1.1","3.10.0","3.11.0","3.12.0","3.13.0","3.13.1","3.14.0","3.15.0","3.16.0","3.17.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0","4.0.0","4.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-7rp6-w7mg-h8rw/GHSA-7rp6-w7mg-h8rw.json"}}],"schema_version":"1.9.0"}